Last updated: 30 October 2026

BAZBAZA INTERNATIONAL TRADING CO. LTD., operating as Little Caesars KSA (“we”, “us” or “our”), is the controller of the personal data described in this policy. We provide restaurant, ordering and related customer services in Saudi Arabia. Our national address and WhatsApp contact appear in section 21.

This policy explains how personal data is collected, used, stored, shared and destroyed in connection with our website, its related pages, the official Little Caesars KSA app, customer accounts, orders, the loyalty programme and customer support. Personal data means information that identifies you directly or indirectly.

When you use the Little Caesars KSA website or app, we process the personal data necessary to provide the services you request in accordance with this policy and applicable law. This policy is available for review through the website and app. Sections 7 and 8 explain service communications, marketing and how to stop marketing messages.

We collect the data needed for the features you use. The categories below do not mean that every category is collected from every visitor.

Account and contact data: your name, registered mobile number, email address if provided, account identifiers, and authentication or verification records associated with the sign-in method used.

Order and delivery data: order numbers, selected products and customizations, branch, delivery address and instructions, contact details needed for handover, order status, invoices, payments and refunds.

Payment-related data: Little Caesars KSA does not store full payment-card details, including full card numbers or card security codes (CVV/CVC). Card-payment details are processed through the payment gateway provider, which is responsible for their confidentiality, security and processing within its services in accordance with its applicable obligations and privacy notice. We retain the transaction information needed to confirm payments, issue invoices and process refunds, such as amounts, payment method, transaction references and payment or refund status. Depending on the payment method, information made available to us may also include a payment token or masked card details. This does not limit any responsibility that applicable law places on Little Caesars KSA. Please do not send full card details, PINs or security codes through customer support.

Loyalty data: the registered mobile number, linked order references, points earned, redeemed, expired or adjusted, balance records and related support requests.

Support and feedback: messages and information you submit through contact forms, surveys or WhatsApp, including order evidence or photographs you choose to provide. Please limit submissions to what is necessary for the enquiry.

Device and usage data: IP address, device and browser information, operating system or app version, access times, pages or features used, technical logs, session identifiers, cookies and similar technologies, as applicable to the service used.

Location and preferences: a delivery address or map point you enter; device location when you permit a location-based feature; language preferences; and requests to stop marketing messages. Device permission to access location is specific to the location-based feature and does not itself authorize use for other purposes.

We obtain data directly when you register, order, enter an address, join the loyalty programme, choose preferences or contact us; automatically through the technical operation of the website and app; and from service providers where needed to complete a payment, deliver an order, operate the service or investigate a problem. We limit such collection to an identified lawful purpose and provide any additional notice required by law.

If you provide another person’s delivery or contact details, provide only what is needed, ensure you are authorized to share it and make this policy available to that person. We use those details for the stated service purpose, not as automatic permission to market to that person.

Providing the requested service: creating and securing your account, processing payment, preparing and delivering orders, administering the loyalty programme and resolving service enquiries. We rely on implementing the agreement with you for processing necessary to provide those services.

Legal obligations: maintaining records required for invoices, accounting and applicable regulatory requirements, responding to lawful requests and meeting our obligations relating to consumer and data-protection rights.

Legitimate interests, where permitted: proportionate fraud prevention, network and information security, investigating misuse and maintaining service reliability. We use this basis only after the required assessment, without processing sensitive data on that basis or overriding your rights and interests.

Other processing: optional features and any additional use of personal data remain subject to the requirements applicable to their specific purposes. Where consent is the legal basis for a processing activity, we explain its purpose and how to withdraw consent. Processing sensitive data is subject to the applicable additional safeguards. Please do not submit sensitive information unrelated to your request.

Some data is necessary for the service you request, such as a contact number, order and payment information, and a delivery address for delivery orders. Without it, we may be unable to create the relevant account, verify it, fulfil the order or resolve your enquiry. We identify required and optional information when collecting it.

You can decline device-location permission and instead enter a delivery address or select a branch manually; location-dependent convenience features may then be limited.

We use the mobile number registered in the official Little Caesars KSA app to link your loyalty account and points transactions, apply programme rules, verify missing or incorrect points and investigate misuse. The earning, redemption and expiry rules are set out in our Terms & Conditions.

Joining the programme does not automatically subscribe you to advertising. Points expiry is separate from data retention: an expired points balance does not require the immediate deletion of transaction records that remain necessary for a lawful purpose.

We may send verification codes, order confirmations, delivery or collection updates, payment and refund notices, responses to your requests, and important account-security messages using the relevant available channels. These communications are limited to providing and protecting the requested service and are distinct from advertising.

We may use the contact details you provide to send Little Caesars KSA offers, news and promotional messages from time to time through SMS, WhatsApp, email or app notifications, in accordance with applicable law.

Order history and preferences may help us provide relevant offers, within the purposes described in this policy and the limits of applicable law. Sensitive data is not used for marketing. Any sharing with advertising platforms or use of precise location for advertising remains subject to the applicable data-protection requirements.

Our marketing messages clearly identify Little Caesars KSA. To stop receiving them, contact us through WhatsApp +966 920 004 171 with the message “Stop advertising messages”, identifying the mobile number or email address receiving the messages so that we can apply the request correctly. We do not charge for opting out. We will include the WhatsApp opt-out link in any marketing messages we send; we stop sending the relevant marketing messages upon receiving your request and record it.

Stopping marketing messages does not prevent necessary order or account-security communications. We keep the minimum record of your stop request needed to respect it and prevent further marketing messages to the contact details concerned.

Cookies and similar technologies, including local storage and session identifiers, can remember preferences, maintain a sign-in session, support a cart and help protect the service. Necessary technologies are used only for their operational or security purposes. Information associated with these technologies can be personal data.

Optional analytics and advertising technologies are handled separately from necessary technologies. Where consent is required, we obtain it before activating the relevant optional technology. You can withdraw that consent, manage available preferences, or use your browser and device controls to block or remove stored information. Blocking necessary technologies may affect sign-in, ordering or other essential features.

Where Google Maps is used to display branches or help select an address, the map service may receive technical data such as your IP address and, if you authorize access or select a location, relevant location data. Google processes data under its applicable privacy notice. You can decline device-location permission and provide the address manually.

Where tools such as Meta Pixel (formerly Facebook Pixel) or similar advertising or analytics tools are enabled, their purposes and relevant data collection must be explained and the required consent obtained before activation. Such tools may associate device identifiers and activity with an advertising platform. Ordinary browsing or a purchase is not consent to this optional advertising processing.

We share only the data needed for the relevant lawful purpose with providers supporting ordering and point-of-sale systems, including Foodics; payment processing and refunds; delivery; account verification and messaging; hosting, system maintenance and security; and customer support. The information shared depends on the service: for example, delivery personnel need the address, contact details and order information necessary for handover.

Where a provider processes data on our behalf, we require appropriate contractual confidentiality, security and purpose-limitation obligations. Providers acting independently for their own lawful functions, such as certain payment or map services, also provide their own privacy notices. Engaging a provider does not remove our responsibilities under applicable law.

We may disclose data to competent authorities when legally required or permitted, and to professional advisers where necessary for a lawful matter. A business restructuring or transfer may involve necessary data disclosure subject to applicable protections and any required notice. This does not create unrestricted permission to share data with advertisers, affiliates or business partners for unrelated purposes.

Personal data is stored and processed in the electronic systems used to provide our services, directly or through service providers, with access limited to authorized purposes. You may contact us through the channels in section 21 for information about how your data is handled.

If a service involves transferring, disclosing or processing personal data outside Saudi Arabia, it must meet the Saudi Personal Data Protection Law and applicable transfer requirements, including the relevant notices, lawful purpose, protection level or appropriate safeguards, minimum necessary data and risk assessment where required.

We retain data only while needed for its stated purpose or an applicable legal requirement. Where a single period cannot be set in advance, the criteria include the duration of the account or service relationship, completion of the order and any refund, unresolved enquiries or claims, applicable invoicing and accounting duties, and the need to demonstrate consent or respect a withdrawal.

Account and loyalty records are retained for programme administration and verified adjustments where needed. Order, payment and invoice records follow the applicable record-keeping requirements. Support records are retained for resolving the enquiry and any necessary follow-up. Technical logs and consent or suppression records are limited to their security or compliance purpose rather than kept indefinitely for marketing.

When no lawful need remains, data is securely destroyed or irreversibly anonymized. Destruction covers applicable copies and backups under a controlled deletion process and legal requirements. If a lawful retention exception prevents immediate destruction, we explain the basis and restrict use to that purpose. Account deletion does not require destruction of records that must lawfully be retained.

We apply technical and organizational safeguards appropriate to the data and risks, including access restrictions, protection of data communications and controls over authorized handling. No online service can promise absolute security. Our responsibilities under applicable law remain unaffected.

We investigate suspected personal-data incidents, take the necessary containment and corrective steps, and notify the competent authority and affected individuals where required by law. Please contact us promptly if you suspect unauthorized access to your account or an exposure of personal data.

Subject to applicable legal conditions and exceptions, you have the right to:

Know why and on what legal basis we collect and process your personal data, and how it is handled.

Access your personal data and request a copy in a clear, readable format.

Request correction, completion or updating of inaccurate or incomplete personal data.

Request destruction of personal data when the legal conditions for destruction are met.

Withdraw consent for consent-based processing. Withdrawal does not affect processing already lawfully carried out or processing that must continue on another valid legal basis.

Raise a privacy complaint with us or the competent authority and seek remedies available under applicable law.

Send a privacy request through WhatsApp +966 920 004 171 or write to our national address in section 21. State the nature of the request and the mobile number linked to the relevant account, if applicable. We may request proportionate verification to protect your data. Do not send passwords, payment security codes or unnecessary identity documents.

We act on requests to exercise personal-data rights without delay and within 30 days. Where the permitted conditions for an extension apply, we may extend this by up to 30 additional days and notify you in advance of the extension and its reasons. If a legal exception applies to a request, we explain the reason as required by law.

You may also submit a complaint to the competent authority through the complaints service on the Saudi Data & AI Authority (SDAIA) Personal Data Protection Platform. Contacting us does not remove your right to approach the competent authority.

Ordering and independent account use require the appropriate legal capacity or authorization of a legal guardian. Where processing requires a guardian’s consent, we obtain and verify that consent as required by Saudi law. If you believe a child has provided data without the required authorization, contact us so we can investigate and take the appropriate protective or deletion steps.

Our service may link to external websites or services. Their own privacy notices govern processing they independently carry out. Review those notices before providing information. This policy continues to describe our own collection and disclosure in connection with the link or integration; an external link does not waive our statutory responsibilities.

If you voluntarily submit a careers enquiry or application through a channel we provide, we use the contact, qualification and experience information you submit to assess and respond to that application. Provide only relevant information. Any additional recruitment notice supplied with the application process explains its specific requirements and retention arrangements. Employee administration is subject to the relevant internal privacy notices.

We update this policy when our services or data practices change, or to reflect legal requirements, and show the revision date above. We provide additional notice of material changes where required. Where a change requires new consent, we obtain it before the relevant processing; continued use alone does not supply that consent.

This policy is governed by the applicable laws of Saudi Arabia, including the Personal Data Protection Law and its regulations. It does not restrict any mandatory right, statutory protection or lawful route for a complaint or remedy.

Operator: BAZBAZA INTERNATIONAL TRADING CO. LTD.
Trading as: Little Caesars KSA

National address: Building 6399, Othman Ibn Affan Branch Road, Al Falah District, Riyadh 13314, Saudi Arabia.
Secondary number: 2728.
Short address: RAFA6399.

WhatsApp for customer support and privacy requests: +966 920 004 171.
Website: littlecaesarsksa.com.